Key points
- CVE-2026-106446 affects Handlebars versions 4.0.0 through 4.7.9.
- The flaw bypasses AST validation added in 4.7.9, allowing arbitrary JavaScript execution.
- Applications using only template strings are not affected by this specific vulnerability.
A critical security flaw in the popular Handlebars templating engine allows attackers to execute arbitrary code on servers. The vulnerability, tracked as CVE-2026-106446, impacts all versions from 4.0.0 up to and including 4.7.9. The vendor has released version 4.7.10 to address the issue.
In plain English
Handlebars is a tool developers use to create dynamic web pages by inserting data into templates. To prevent attacks, version 4.7.9 added a safety check for pre-parsed template structures known as Abstract Syntax Trees (ASTs). However, this check was incomplete. It only verified certain types of data nodes, ignoring others.
An attacker can craft a malicious data object that passes this limited check. When the application processes this object, the unchecked data is written directly into the generated JavaScript code. This allows the attacker to inject and run their own code on the server, potentially taking control of the application or stealing data.
The background
According to the GitHub advisory GHSA-8r5x-fm3f-whwj, the vulnerability exists because the compiler writes several AST values into the generated code without further validation. This bypasses the protections added in 4.7.9 for previous vulnerabilities, including GHSA-2w6w-674q-4c4q, GHSA-xhpv-hc6g-r9c6, and GHSA-3mfm-83xf-c92r.
The flaw is triggered when an application passes an untrusted object to the `compile()` or `precompile()` functions. This often happens if an application accepts a parsed JSON request body from a user and feeds it directly into Handlebars. If the application only ever passes standard text strings to these functions, it is not affected.
What changes now
Developers using Handlebars versions 4.0.0 through 4.7.9 must upgrade to version 4.7.10 immediately. This update includes the necessary fixes to properly validate all AST nodes. Organizations should audit their applications to identify any instances where user-controlled data might be passed to Handlebars compilation functions.
What to do and how to stay safe: Handlebars
- Inventory all applications and services that use the Handlebars npm package to determine if they are running vulnerable versions.
- Upgrade to Handlebars version 4.7.10 as soon as possible to mitigate the risk of remote code execution.
- Review application code to ensure that untrusted user input is not passed directly to `compile()` or `precompile()` functions.
- Monitor server logs for unusual JavaScript execution or unexpected behavior that could indicate an exploitation attempt.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability affect all Handlebars users?
No, applications that only pass template strings to Handlebars are not affected; only those passing untrusted objects to compile or precompile functions are at risk.
What is the severity of CVE-2026-106446?
The vulnerability is rated as critical severity by the GitHub advisory.
Is there a fix available for this issue?
Yes, the vendor has released Handlebars version 4.7.10 which patches the vulnerability.
